writeup-passcode

最新推荐文章于 2023-05-10 18:35:42 发布

原创最新推荐文章于 2023-05-10 18:35:42 发布 · 588 阅读

0 ·

CC 4.0 BY-SA版权

二进制-逆向工程专栏收录该内容

34 篇文章

订阅专栏

本文介绍了一种基于passcode的登录系统破解过程。通过分析源码发现漏洞，并利用GDB进行调试，最终通过构造特定payload完成flag获取。

Mommy told me to make a passcode based login system.
My initial C code was compiled without any error!
Well, there was some compiler warning, but who cares about that?

ssh passcode@pwnable.kr -p2222 (pw:guest)
题目如上

拿到题目，先分析下源码

代码如下

#include <stdio.h>
#include <stdlib.h>

void login(){
    int passcode1;
    int passcode2;

    printf("enter passcode1 : ");
    scanf("%d", passcode1);
    fflush(stdin);

    // ha! mommy told me that 32bit is vulnerable to bruteforcing :)
    printf("enter passcode2 : ");
        scanf("%d", passcode2);

    printf("checking...\n");
    if(passcode1==338150 && passcode2==13371337){
                printf("Login OK!\n");
                system("/bin/cat flag");
        }
        else{
                printf("Login Failed!\n");
        exit(0);
        }
}

void welcome(){
    char name[100];
    printf("enter you name : ");
    scanf("%100s", name);
    printf("Welcome %s!\n", name);
}

int main(){
    printf("Toddler's Secure Login System 1.0 beta.\n");

    welcome();
    login();

    // something after login...
    printf("Now I can safely trust you that you have credential :)\n");
    return 0;   
}